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DETAILED ACTION 

1 . This action is in response to the amendment filed 04/1 3/2005. 


Response to Arguments 

2. Applicant's arguments filed 04/1 3/2005 have been fully considered but they are 
not persuasive. Applicant argues, in the 2 nd paragraph of page 3, that Riggins 
(6,766,454) does not teach the claimed transmission of a password based on lines 63- 
66 of column 2, "It will be appreciated that the system and method of the present 
invention never send the password itself across the computer network and thus never 
compromise the password by transmission across unsecured channels." Riggins 
discloses that the downloaded applet having authentication information of the user 
authenticates itself to the service server protected by a firewall (col. 9, lines 5-20; fig. 1). 
Riggins further discloses that the authentication information of the user is retrieved from 
a keysafe at the global server and includes firewall password information which can be 
a password or a hashed password (col. 4, lines 60-65; col. 6, line 66 - col. 7, line 7; col. 
1 1 , lines 5-8). Even if a hashed password is used, the hashed password is still a 
password and therefore, meets the limitation of a password. Also in the 2 nd paragraph 
of page 3, applicant argues that the global server maintains the password for the user to 
pass the firewall and there is no need to transmit the password to the client. Riggins 
discloses that there are 3 modes for the user to access a service server one of which is 
that the user has direct access to the service server using the downloaded applet 
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discussed above. In this mode, password is transmitted from the global server to the 
client computer (col. 8, lines 16-36; figure 8A). 

Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

4. Claims 1 -4, 1 6-1 9 and 32-35 are rejected under 35 U.S.C. 1 02(e) as being 
anticipated by Riggins (6,766,454). 

Regarding claims 1,16 and 32 (claim 1 being exemplary), Riggins discloses a 
telecommunications system adapted to provide a visitor's computer with access to at 
least one application, comprising: an application computer storing at least one 
application (fig. 1, elements 108 a-c); a firewall protecting said application computer (fig. 
1, elements 104, 120); an administration computer linked to said application computer 
(fig. 1 , element 1 06), said administration computer adapted to generate a set of applets 
which meet the limitation of an electronic badge and adapted to transmit said electronic 
badge to the visitor's computer (fig. 1 , elements 1 14 a-g; fig. 5, step 530), said 
electronic badge including a password conferring access of the visitor's computer 
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through said firewall to said at least one application (col. 4, lines 60-65; col. 6, line 66 - 
col. 7, line 7; col. 9, lines 5-20). 

Regarding claims 2, 17 and 33, Riggins further discloses that the administration 
computer and the application computer are realized on a single data processing 
machine (col. 9, lines 55-59). 

Regarding claims 3, 18 and 34, Riggins further discloses that the administration 
computer and the application computer are distinct data processing machines (fig. 1 , 
elements 106 and 108 a-b) and said firewall is located in said administration computer 
(col. 6, lines 5-15). 

Regarding claims 4, 19 and 35, Riggins further discloses that the administration 
computer is protected by a firewall (fig. 1, element 104). 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claims 5-13, 20-23, 25-27 and 36-43 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Riggins as applied to claims 1, 16 and 32 above, and further in 
view of Hudson et al. (6,055,637). 
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Regarding claims 5, 20 and 36, Riggins does not disclose a single applet for 
accessing all authorized services. However, Riggins discloses a set of applets 
downloaded together and each responsible for accessing a separate authorized service. 
It is well known in the art that a large program can comprise multiple modules each 
performing a separate task for ease of development and maintenance. In addition, the 
applets implemented in the Riggins reference meet the definition of a Java applet in that 
applets are small programs. Therefore, the Riggins set of applets meets the limitation 
of the claimed applet. Riggins discloses that the applet contains an identifier (col. 4, 
lines 60-65; col. 9, lines 5-20). However, Riggins does not disclose that the applet 
contains a list of access rights. Hudson discloses a system for controlling access to 
resources utilizing a credential token that contains a user ID, a password and a list of 
access right (col. 2, line 67 - col. 3, line 4; lines 23-28, 31-38); the token allows 
authorized access to resources, so it is functionally equivalent to an electronic badge. It 
would have been obvious to one of ordinary skill in the art at the time the invention was 
made to modify the system of Riggins such that the electronic badge contains a list of 
access rights, as taught by Hudson. The motivation for doing so would have been that 
the access control system of each service needs not permanently store information 
associated with user and therefore, user information may be updated quickly and 
efficiently (col. 1, lines 42-48; col. 6, lines 23-27). 

Regarding claims 6, 21 and 37, Hudson's list of access rights of claim 5 permits 
access to additional applications (col. 3, lines 4-5 and fig. 1). 
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Regarding claims 7, 22 and 38, Riggins further discloses that the applet is 
adapted to run on the visitor's computer and cause one or more icons to be displayed 
(col. 5, lines 32-42). 

Regarding claims 8, 23 and 39, Riggins further discloses a Web server adapted 
to issue electronic badges (fig. 3, elements 387, 388). Riggins does not disclose that 
the administration computer includes a control panel. Hudson discloses an 
administrator issuing credential token utilizing a security database, the token allows 
authorized access to resources, so it is functionally equivalent to an electronic badge 
(see Abstract; col. 4, lines 50-58). Hudson does not explicitly disclose that the 
administration computer includes a control panel. However, this feature is deemed to 
be inherent to the Hudson system. The administrator would not be able to issue 
credential token without a control panel. It would have been obvious to one of ordinary 
skill in the art at the time the invention was made to modify the system of Riggins such 
that the administration computer includes a control panel adapted to issue electronic 
badges, as taught by Hudson, and accordingly, the control panel is linked to the Web 
server. The motivation for doing so would have been to allow the administrator to 
perform issuing of tokens. 

Regarding claims 9, 25 and 40, Riggins does not discloses that the 
administration computer includes a control server linked to the control panel and a 
database of access rules linked to the control server. Hudson further discloses that the 
administration computer of claim 8 includes a control server linked to the control panel 
and a database of access rules linked to the control server (see fig. 3, col. 4, lines 55- 
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58). It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the system of Riggins such that the administration 
computer includes a control server linked to the control panel and a database of access 
rules linked to the control server, as taught by Hudson. The motivation for doing so 
would have been that the administrator could have access to users' identification and 
authorization information. 

Regarding claims 10, 26 and 41, Riggins further discloses that the administration 
computer comprises a firewall protecting the application computer (col. 6, lines 5-15; 
col. 9, lines 55-59). 

Regarding claims 11 , 27 and 42, Riggins discloses that access to the Web server 
is controlled by password protection (fig. 14, step 1410). 

Regarding claims 12 and 43, Riggins further discloses that the electronic badge 
is deposited for collection on the Web server (fig. 3, elements 387, 388). 

Regarding claim 13, Riggins further discloses that the visitor's computer can 
download said electronic badge by accessing said web server and by giving a password 
and visitor identification (fig. 14, step 1410). 

7. Claims 14 and 44 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Riggins in view of Hudson as applied to claim 8 and 36 above, and further in view 
of Scheifler et al. (6,138,238). Riggins and Hudson do not disclose that the access 
rights associated with the electronic badge can be changed dynamically. Scheifler 
discloses a system regulating access to resources in which access rights associated 
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with a principle can be changed dynamically (col. 4, lines 26-29). It would have been 
obvious to one of ordinary skill in the art at the time the invention was made to modify 
the system of Riggins and Hudson such that the access rights associated with the 
electronic badge can be changed dynamically, as taught by Scheifler, so that the 
security in computer systems could be enhanced (col. 4, lines 54-56). 

8. Claim 1 5 rejected under 35 U.S.C. 1 03(a) as being unpatentable over Riggins in 
view of Hudson as applied to claim 8 above, and further in view of Montulli (5,774,670). 
Riggins and Hudson do not disclose that the electronic badge is deleted by a signal 
from the control server. Montulli discloses a cookie being deleted by a signal from a 
server; the cookie is functionally equivalent to the electronic badge (col. 9, lines 34-41). 
It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the system of Riggins and Hudson such that the electronic badge 
is deleted by a signal from the control server, as taught by Montulli, so that the server 
(col. 4, lines 54-56) so that the server could remove undesired cookies previously sent 
to a client. 

9. Claims 24 and 28-29 are rejected under 35 U.S.C. 1 03(a) as being unpatentable 
over Riggins in view of Hudson as applied to claim 23 above, and further in view of Daly 
et al. (5,875,394). 

Regarding claim 24, Riggins and Hudson do not disclose the steps of 
establishing a voice link over the PSTN between the user of the visitor's computer and 
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an operator at the administration center, the operator verifying the user and assigning 
and communicating a password to the user over the voice link. Daly discloses a 
process for securely assigning a password comprising the steps of establishing a voice 
link over the PSTN between a user and an operator at the administration center, the 
operator verifying the user and assigning and communicating a password to the user 
over the voice link (see fig. 3). It would have been obvious to one of ordinary skill in the 
art at the time the invention was made to modify the method of Riggins and Hudson to 
include the steps of establishing a voice link over the PSTN between the user of the 
visitor's computer and an operator at the administration center, the operator verifying 
the user and assigning and communicating a password to the user over the voice link, 
as taught by Daly, in order to avoid the risk of piracy (col. 2, lines 33-36). 

Regarding claim 28, Riggins further discloses that the electronic badge is 
deposited for collection on the Web server (fig. 3, elements 387, 388). 

Regarding claim 29, Riggins further discloses that the visitor enters said 
password to download said electronic badge (fig. 14, step 1410). 

10. Claim 30 is rejected under 35 U.S.C. 103(a) as being unpatentable over Riggins, 
Hudson and Daly as applied to claim 24 above, and further in view of Susaki et al. 
(6,189,032). Riggins, Hudson and Daly do not disclose the steps of said visitor 
requesting access, while connected to said application computer, to a first software 
application, not pre-authorized on said electronic visitor's badge, said control panel 
giving an alarm condition, said host confirming over said voice link that the said visitor 
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has requested access to the first software application, and modifying the access rights 

associated with the electronic visitor's badge via said control panel. Susaki discloses a 

method for controlling access rights to services comprising the steps of a user 

requesting access, while connected to said application computer, to a service, not pre- 

authorized according to the user's access rights, giving an alarm condition, confirming 

that the user has requested access to the service, and modifying the access rights 

associated with the user (col. 3, lines 41-54). It would have been obvious to one of 

ordinary skill in the art at the time the invention was made to modify the method of 

Riggins, Hudson and Daly to include the steps of said visitor requesting access, while 
» 

connected to said application computer, to a first software application, not pre- 
authorized on said electronic visitor's badge, said control panel giving an alarm 
condition, said host confirming over said voice link that the said visitor has requested 
access to the first software application, and modifying the access rights associated with 
the electronic visitor's badge via said control panel, as taught by Susaki, so that access 
to services that need approval and consent by another party could properly be 
controlled (col. 3, lines 55-59). 

1 1 . Claim 31 is rejected under 35 U.S.C. 103(a) as being unpatentable over Riggins, 
Hudson and Daly as applied to claim 24 above, and further in view of Montulli. Riggins, 
Hudson and Daly do not disclose that the electronic badge is deleted by a signal from 
the control server. Montulli discloses a cookie being deleted by a signal from a server; 
the cookie is functionally equivalent to the electronic badge (col. 9, lines 34-41 ). It 
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would have been obvious to one of ordinary skill in the art at the time the invention was 
made to modify the method of Riggins, Hudson and Daly such that the electronic badge 
is deleted by a signal from the control server, as taught by Montulli, so that the server 
(col. 4, lines 54-56) so that the server could remove undesired cookies previously sent 
to a client. 

Conclusion 

12. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Minh Dinh whose telephone number is 571-272-3802. 
The examiner can normally be reached on Mon-Fri: 10:00am-6:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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